AI agent vulnerability · PandasAI
CVE-2023-39661: PandasAI vulnerable to arbitrary code execution
criticalCVSS 3.1 9.8GHSA-8fp9-43pw-56vw
An issue in pandas-ai v.0.8.1 and before allows a remote attacker to execute arbitrary code via the isjailbreak function.
Published Aug 15, 2023 · Updated Nov 7, 2023
Affected packages
pandasai
- Ecosystem
- PyPI
- Affected
- <= 0.8.1
- Fixed in
- No patched version yet
- Check
pip show pandasai
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
An issue in pandas-ai v.0.8.1 and before allows a remote attacker to execute arbitrary code via the _is_jailbreak function.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology